This invention is related in general to digital processing systems and more specifically to enforcing security restrictions in a processing platform by ensuring that processes executing on the platform are known, or trusted.
In many of today's computing or processing applications it is desirable for a manufacturer, distributor or owner of content or information to be able to protect the content from misuse. For example, a Digital Versatile Disk (DVD) player is used by consumers to show movies and video that is typically proprietary. The owner of the movie content wishes to prevent a user from unauthorized copying, distribution or other handling of the content. Similarly, a compact disc (CD) player can have the same concerns with respect to music or other audio information. Other processing systems may have proprietary content in the form of software application programs, games, etc. In each of these cases protecting the content can be difficult since the processing platform and applications (e.g., DVD player, CD player, game console, etc.) are under the control of the end user who typically operates the processing platform in their home.
One approach to ensuring protection of content is to create a “trusted platform” in a consumer playback device so that a consumer is restricted from misuse of the content. Such a trusted platform only allows known, or trusted, processes to execute so that undesirable functionality, such as undesirable copying of the content, is inhibited. A prior art approach to achieving a trusted platform includes standards promulgated by Trusted Computing Group (TCG, formerly Trusted Computing Platform Alliance (TCPA)) such as TCG Trusted Platform Module (TPM) v1.2 Specification Revision 62, Oct. 2, 2003. This specification design includes a hardware chip TPM and related functions that provide mechanisms to establish certain levels of trusts to local and remote platforms.
A TPM is integrated into a platform and protects a set of Platform Configuration Registers (PCRs) for storing runtime configurations of the platform. Platform configurations are measured (e.g., hashed) and extended (or accumulated) into PCRs. TCG specifies some protected functions for applications to query platform configurations. Using these functions, an application is able to acquire configurations for local or remote platforms.
A trusted chain is established by measuring platform configurations and extending the values to PCRs during a boot sequence. At platform power-on or reset, a root process of the trust module measures system hardware and firmware configurations including the Initial Program Loader (IPL or operating system (OS) loader). The measurements are extended to PCRs before passing over the platform control to the OS loader; The OS loader, in turn, measures the kernel image and related configurations before handling over the system control to the kernel image.
Using these mechanisms it is possible to establish a trusted chain through a boot sequence from power-on to loading and execution of a kernel image. However, this mechanism does not ensure that the platform can remain in the trusted state after the kernel has taken control of the system. In some platforms, the runtime kernel can be altered or even completely replaced after boot. In such a case, the PCR values and other security mechanisms may not be effective. For example, the PCR values may not reflect the actual configurations, especially the kernel image, so that the platform is no longer a trusted platform and can be exploited.